{"id":159,"date":"2026-05-28T14:58:30","date_gmt":"2026-05-28T13:58:30","guid":{"rendered":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/05\/28\/how-workplace-security-friction-is-driving-shadow-ai-risks\/"},"modified":"2026-06-16T16:31:24","modified_gmt":"2026-06-16T15:31:24","slug":"how-workplace-security-friction-is-driving-shadow-ai-risks","status":"publish","type":"post","link":"https:\/\/www.intelligentciso.com\/middle-east\/2026\/05\/28\/how-workplace-security-friction-is-driving-shadow-ai-risks\/","title":{"rendered":"How workplace security friction is driving shadow AI risks"},"content":{"rendered":"\n

Patricia Leppert, Team Manager Customer Trust and Security, TeamViewer, says employees are increasingly turning to unsanctioned AI tools and personal devices when workplace security controls become too restrictive or impractical – creating hidden cybersecurity and governance risks for organisations.<\/em><\/p>\n\n\n\n

Security is meant to protect the business. Yet when it creates too much friction, it can have the opposite effect.<\/p>\n\n\n\n

For many employees, security is still experienced as something that interrupts the working day. It might be a password reset at the wrong moment, an approval process that slows a project down or a blocked platform that makes a simple task feel harder than it should. These controls may exist for good reasons, but when they are not designed for how people actually work, they can push employees towards the very behaviours organisations are trying to avoid.<\/p>\n\n\n\n

Shadow AI is a symptom of workplace friction<\/strong><\/p>\n\n\n\n

Shadow AI is a clear example of this. Employees are under pressure to work quickly while managing more information than ever. If approved systems are difficult to access, limited in functionality or unclear, people may turn to personal devices, public AI platforms or unsanctioned applications.<\/p>\n\n\n\n

In most cases, this is not malicious. Employees are trying to solve a problem, whether that is meeting a deadline, responding to a customer or keeping a project moving. That is what makes shadow AI so difficult to manage. The same instinct that drives productivity can also create hidden exposure.<\/p>\n\n\n\n

Our Digital Friction Report found that on average 40% of employees across the world admit to using personal devices or applications as workarounds when workplace technology fails. In India, this rises to 66% and in the US it reaches 51%. These figures should be a warning sign for leaders. Workarounds are not edge cases. They are becoming part of everyday working behaviour.<\/p>\n\n\n\n

The risk is not only that employees use tools the business has not approved. It is that these behaviours reduce visibility. Organisations cannot govern what they cannot see and they cannot secure activity that sits outside official systems. When too much security friction pushes work into unmanaged environments, it can make the business less secure, not more.<\/p>\n\n\n\n

A security issue<\/strong><\/p>\n\n\n\n

Shadow AI is often framed as a technology problem, but that only tells part of the story. It is also a sign that security, governance and employee experience are not working together effectively.<\/p>\n\n\n\n

Sensitive information could be entered into platforms that have not been approved or monitored, while teams may start relying on outputs or tools that sit outside official oversight. Yet focusing only on the tool can miss the wider issue. Shadow AI often appears because the approved route feels too slow, unclear or disconnected from the task at hand.<\/p>\n\n\n\n

Employees may not know which tools they are allowed to use. They may be unsure what information can safely be entered into an AI platform. In some cases, the sanctioned tools simply do not support the way a team needs to work.<\/p>\n\n\n\n

Leaders should treat this as a signal, not just a policy failure, but a design failure. It shows where employees are experiencing friction and where security may be creating gaps rather than closing them.<\/p>\n\n\n\n

Poor digital experiences create business risk<\/strong><\/p>\n\n\n\n

That friction has a measurable cost. The same research found that 80% of respondents lose time to dysfunctional IT, costing them an average of 1.3 workdays per month.<\/p>\n\n\n\n

It is also affecting business performance, with almost half saying it has delayed critical operations or projects.<\/p>\n\n\n\n

What starts as everyday frustration can quickly become a wider business problem, slowing teams down and weakening trust in workplace technology.<\/p>\n\n\n\n

The challenge is to make the secure route the practical one, with controls that support how people actually work rather than interrupting it.<\/p>\n\n\n\n

Security needs to enable productivity<\/strong><\/p>\n\n\n\n

Security should enable productivity, not compete with it. That means making secure processes clear enough to follow and practical enough to fit into daily workflows. When security feels intuitive, employees are far more likely to engage with it.<\/p>\n\n\n\n

Authentication is a useful example. Passwords have long been a source of frustration for employees, as well as a known weakness for organisations. Moving towards approaches such as zero trust and biometric authentication can strengthen protection while improving the user experience. The strongest controls are often the ones that feel almost invisible to the people using them.<\/p>\n\n\n\n

Trust is central to this. That lack of confidence matters: 57% of workers do not trust their IT team to resolve issues quickly or effectively, while 47% fear their IT team will not adequately protect personal or work-related data. If employees do not trust that official routes will meet their needs, they are more likely to find their own.<\/p>\n\n\n\n

The report also points to a growing confidence gap around AI, with 62% of employees lacking confidence that their IT teams are providing the latest AI and digital tools. That matters because employees will not wait indefinitely for the organisation to catch up. If the tools they need are not available through approved channels, they may look elsewhere.<\/p>\n\n\n\n

AI governance must be part of daily work<\/strong><\/p>\n\n\n\n

This is where governance becomes critical. AI tools can enter an organisation through different teams, often for different reasons. A small productivity experiment can quickly become part of a core workflow, even if no one has clearly defined who owns the risk.<\/p>\n\n\n\n

As adoption grows, that governance gap becomes harder to ignore.<\/p>\n\n\n\n

Businesses need clearer responsibility for how AI is used and secured. Security teams have an essential role, but they cannot solve this alone. AI governance has to become part of the organisation\u2019s operating model, rather than a policy that sits separately from day-to-day work. This requires a shift in mindset, embedding responsible AI use into the organisation\u2019s DNA so it shapes everyday decisions and behaviours.<\/p>\n\n\n\n

Human oversight is also essential. AI can process information at speed, but it does not understand every business context or reputational consequence. People are needed to challenge AI outputs and take responsibility for decisions that carry real-world impact.<\/p>\n\n\n\n

For employees, this needs to translate into practical guidance. They should understand which tools are approved and what information should never be entered into them. That guidance also needs to be available when people need it. A policy that is difficult to find or hard to interpret will not change behaviour.<\/p>\n\n\n\n

Building that trust also requires diverse perspectives in how security is designed. Teams that reflect different working styles and expectations are better equipped to create systems that are inclusive, usable and resilient in practice. Security cannot be designed for a single type of user if it is meant to work in practice.<\/p>\n\n\n\n

At the same time, as regulatory expectations around AI continue to evolve, organisations that already embed security into everyday workflows will be better positioned to scale responsibly.<\/p>\n\n\n\n

Reducing shadow AI starts with understanding the cause<\/strong><\/p>\n\n\n\n

Reducing shadow AI starts with understanding why employees are using unsanctioned tools in the first place. Leaders need to look closely at where approved systems fall short and where security is being introduced too late.<\/p>\n\n\n\n

Too often, security is brought in after a tool or process has already been adopted. By that point, controls can feel like an extra layer rather than a natural part of the workflow. A security-by-design approach changes this. It brings security into the conversation earlier, so risks can be addressed before behaviours become embedded.<\/p>\n\n\n\n

Transparency is another crucial ingredient. Customers, partners and employees increasingly want to understand how organisations are using AI and how data is being protected. Therefore, security can no longer sit behind the scenes as a black box.<\/p>\n\n\n\n

Internally, that transparency is just as important. Employees are more likely to follow security guidance when they understand why it exists and how it supports the wider business. A policy that simply says \u201cdo not use this tool\u201d is unlikely to be enough. People need context and confidence that the approved route will help them do their jobs effectively.<\/p>\n\n\n\n

Ultimately, cybersecurity discussions often focus on external threats, but organisations also need to pay attention to the risks being created inside their own walls, many of which are not a result of malicious intent. So, what does shadow AI really reflect? Not simply employees breaking rules, but a sign that workplace systems need to evolve with changing ways of working, making secure and responsible AI use part of the organisation\u2019s DNA. Reducing risk will depend on employers making secure tools practical, accessible and easy for employees to adopt.<\/p>\n\n\n\n

The organisations that succeed will not be those with the strictest controls, but those that make secure behaviour the easiest path to follow.<\/p>\n","protected":false},"excerpt":{"rendered":"

Patricia Leppert, Team Manager Customer Trust and Security, TeamViewer, says employees are increasingly turning to unsanctioned AI tools and personal devices when workplace security controls become too restrictive or impractical – creating hidden cybersecurity and governance risks for organisations. Security is meant to protect the business. Yet when it creates too much friction, it can […]<\/p>\n","protected":false},"author":58,"featured_media":160,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[55,495,71,16,51],"tags":[169,74,170,171,78,161,172,173,174,175,85,176,177,178,179],"class_list":["post-159","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","category-artificial-intelligence","category-cybersecurity","category-insights","category-top-stories","tag-ai-governance","tag-ai-security","tag-biometric-authentication","tag-cyber-risk","tag-cybersecurity","tag-digital-transformation","tag-employee-productivity","tag-enterprise-ai","tag-it-governance","tag-secure-workflows","tag-shadow-ai","tag-teamviewer","tag-workplace-security","tag-workplace-technology","tag-zero-trust"],"acf":[],"publishpress_future_action":{"enabled":false,"date":"2026-10-25 23:23:45","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/comments?post=159"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/159\/revisions"}],"predecessor-version":[{"id":392,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/posts\/159\/revisions\/392"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media\/160"}],"wp:attachment":[{"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/media?parent=159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/categories?post=159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentciso.com\/middle-east\/wp-json\/wp\/v2\/tags?post=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}